fix: address verified review findings (pulls-1)

Signed-off-by: bircni <bircni@icloud.com>

internal/app/pull_create.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -116,7 +117,7 @@ is not on the remote yet is pushed first, with its upstream set.`, Args: argsExa
 			}
 		}
 		if web {
-			return a.openBrowser(cmd, repositoryURL(t)+"/compare/"+options.Base+"..."+options.Head)
+			return a.openBrowser(cmd, repositoryURL(t)+"/compare/"+compareRef(options.Base)+"..."+compareRef(options.Head))
 		}
 		var commitBody string
 		if options.Title == "" {
@@ -373,3 +374,9 @@ func (a *application) reportCreatedPull(cmd *cobra.Command, t target, item servi
 	a.done(cmd, "Created pull request %s", refLabel(t.Repo, item.Number, item.Title))
 	return a.created(cmd, item, item.URL)
 }
+
+// compareRef escapes a branch name, or OWNER:BRANCH, for a compare URL, where a '#' or '%' in the
+// name would otherwise start a fragment or an invalid escape.
+func compareRef(ref string) string {
+	return strings.ReplaceAll(url.PathEscape(ref), "%2F", "/")
+}